CVE-2026-10067: Shibby Tomato multimon.cgi sub_90F0 stack-based overflow

Synopsis

A stack-based buffer overflow exists in the sub_90F0 function of multimon.cgi in Shibby Tomato 1.28, an end-of-life router firmware now superseded by FreshTomato. The bug is reachable over the network by any authenticated user, with no victim interaction needed, and successful exploitation lets the attacker corrupt stack memory to read sensitive data, tamper with router state, or crash the device, with code execution likely on this class of embedded target. No upstream fix is available; HarborGuard tracks the advisory and will surface a patched rebuild as soon as one ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach multimon.cgi over the network, typically the router's HTTP management interface.

• AuthenticationRequired

  A low-privilege account on the router is sufficient to invoke the vulnerable CGI handler.

• Victim interactionNot required

  No user action is needed; the attacker sends the crafted request directly.

• Attack complexityDetail

  Attack complexity is low, meaning the overflow triggers reliably without race conditions or environmental tuning.

Blast Radius

• Corrupts stack memory in the multimon.cgi process, which on this class of embedded firmware typically yields arbitrary code execution as the web server user.
• Reads sensitive router state including credentials, WPA keys, and configuration stored in nvram.
• Tampers with routing, firewall, and DNS settings to redirect or intercept traffic on the LAN.
• Crashes the management daemon or the device itself, disrupting connectivity for everyone behind the router.